Plugin security history

Events Manager – Calendar, Bookings, Tickets, and more! Vulnerability History & Security Timeline

The Wordfence Intelligence dataset currently contains 36 vulnerability records associated with Events Manager – Calendar, Bookings, Tickets, and more!, published between 2012 and 2026.

Dataset last synchronized: 2026-08-03 00:31:25 UTC

At a glance

Security Snapshot

36Total records

1Critical

6High

28Medium

0Low

1Informational

36Patched records

0Currently marked unpatched

2012-05-22First disclosure

2026-07-08Latest disclosure

34 of 36CVE coverage

Year-by-Year Timeline

Year	Records	Relative volume
2012	1	1 records
2013	2	2 records
2014	3	3 records
2015	4	4 records
2018	3	3 records
2019	1	1 records
2020	4	4 records
2023	1	1 records
2024	7	7 records
2025	8	8 records
2026	2	2 records

Severity Breakdown

Severity	Records	Share
Critical	1	2.8%
High	6	16.7%
Medium	28	77.8%
Informational	1	2.8%

Vulnerability-Type Breakdown

Cross-Site Scripting

22 records61.1%

First: 2012. Latest: 2025.

Other

4 records11.1%

First: 2015. Latest: 2026.

SQL Injection

4 records11.1%

First: 2020. Latest: 2026.

CSRF

3 records8.3%

First: 2024. Latest: 2025.

Missing Authorization

2 records5.6%

First: 2024. Latest: 2025.

Information Disclosure

1 record2.8%

First: 2025. Latest: 2025.

Patch Status

Patched: 36
Currently marked unpatched: 0
Unknown status: 0

Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.

Latest Known Patched Versions

7.3.7
7.2.3
7.2.2.3
7.0.4
6.6.5
6.6.4.2
6.6.4
6.4.9
6.4.8
6.4.7.2
6.4.7
6.4.6
5.9.8
5.9.7.2
5.9.6
5.9.5
5.9
5.8.1.2
5.6
5.5.7.1
5.5.7
5.5.2
5.3.9
5.3.5
5.5
5.3.6.1
5.1.7

Affected-Version History

Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.

Affected range	Vulnerability	Published	Patched version	Severity
`*-7.3.6`	Events Manager – Calendar, Bookings, Tickets, and more! <= 7.3.6 - Unauthenticated PHP Object Injection	July 8, 2026	7.3.7	High
`*-7.3.6`	Events Manager <= 7.3.6 - Unauthenticated SQL Injection	July 1, 2026	7.3.7	High
`*-7.2.2.1`	Events Manager <= 7.2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'events_list_grouped' Shortcode	December 17, 2025	7.2.3	Medium
`*-7.2.2.2`	Events Manager – Calendar, Bookings, Tickets, and more! <= 7.2.2.2 - Cross-Site Request Forgery to Location Deletion	December 11, 2025	7.2.2.3	Medium
`*-7.2.2.2`	Events Manager <= 7.2.2.2 - Unauthenticated Information Exposure	December 11, 2025	7.2.2.3	Medium
`7.0.1-7.0.3`	Events Manager <= 7.0.3 - Authenticated(Contributor+) Stored Cross-Site Scripting via Plugin Shortcodes	July 9, 2025	6.6.5, 7.0.4	Medium
`*-6.6.4.4`	Events Manager <= 7.0.3 - Authenticated(Contributor+) Stored Cross-Site Scripting via Plugin Shortcodes	July 9, 2025	6.6.5, 7.0.4	Medium
`7.0.1-7.0.3`	Events Manager <= 7.0.3 - Unauthenticated SQL Injection via `orderby` Parameter	July 9, 2025	6.6.5, 7.0.4	High
`*-6.6.4.4`	Events Manager <= 7.0.3 - Unauthenticated SQL Injection via `orderby` Parameter	July 9, 2025	6.6.5, 7.0.4	High
`7.0.1-7.0.3`	Event Manager <= 7.0.3 - Reflected Cross-Site Scripting via `calendar_header` Parameter	July 9, 2025	6.6.5, 7.0.4	Medium
`*-6.6.4.4`	Event Manager <= 7.0.3 - Reflected Cross-Site Scripting via `calendar_header` Parameter	July 9, 2025	6.6.5, 7.0.4	Medium
`*-6.6.4.1`	Events Manager – Calendar, Bookings, Tickets, and more! <= 6.6.4.1 - Missing Authorization	February 26, 2025	6.6.4.2	Medium
`*-6.6.3`	Events Manager – Calendar, Bookings, Tickets, and more! <= 6.6.3 - Unauthenticated SQL Injection via Event Status Parameter	February 20, 2025	6.6.4	High
`*-6.4.8`	Events Manager <= 6.4.8 - Reflected Cross-Site Scripting	June 28, 2024	6.4.9	Medium
`*-6.4.7.3`	Events Manager – Calendar, Bookings, Tickets, and more! <= 6.4.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via event, location, and event_category Shortcodes	June 11, 2024	6.4.8	Medium
`*-6.4.7.1`	Events Manager <= 6.4.7.1 - Cross-Site Request Forgery	March 28, 2024	6.4.7.2	Medium
`*-6.4.6.4`	Events Manager <= 6.4.6.4 - Missing Authorization	March 28, 2024	6.4.7	Medium
`*-6.4.7.1`	Events Manager <= 6.4.7.1 - Cross-Site Request Forgery	March 27, 2024	6.4.7.2	Medium
`*-6.4.7.1`	Events Manager <= 6.4.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting	March 27, 2024	6.4.7.2	Medium
`*-6.4.6.4`	Events Manager <= 6.4.6.4 - Authenticated(Administator+) Stored Cross-Site Scripting via settings	February 28, 2024	6.4.7	Medium
`*-6.4.5`	Events Manager <= 6.4.5 - Reflected Cross-Site Scripting	November 23, 2023	6.4.6	Medium
`*-5.9.7.3`	Events Manager <= 5.9.7.3 - Cross-Site Scripting	June 7, 2020	5.9.8	Medium
`*-5.9.7.3`	Events Manager <= 5.9.7.3 - Admin+ SQL Injection	June 7, 2020	5.9.8	High
`[*, 5.9.7.2)`	Events Manager < 5.9.7.2 & Events Manager Pro < 2.6.7.2 - Unauthenticated CSV Injection	February 6, 2020	5.9.7.2	High
`*-5.9.7.1`	Events Manager <= 5.9.7.1 - CSV Injection	February 5, 2020	5.9.7.2	Medium

Selected source records

Latest Records

HighCVE-2026-57713

Events Manager – Calendar, Bookings, Tickets, and more! <= 7.3.6 - Unauthenticated PHP Object Injection

Published: July 8, 2026

Affected versions: *-7.3.6
Patched versions: 7.3.7

Original Wordfence record

HighCVE-2026-12987

Events Manager <= 7.3.6 - Unauthenticated SQL Injection

Published: July 1, 2026

Affected versions: *-7.3.6
Patched versions: 7.3.7

Original Wordfence record

MediumCVE-2025-12976

Events Manager <= 7.2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'events_list_grouped' Shortcode

Published: December 17, 2025

Affected versions: *-7.2.2.1
Patched versions: 7.2.3

Original Wordfence record

MediumCVE-2025-12407

Events Manager – Calendar, Bookings, Tickets, and more! <= 7.2.2.2 - Cross-Site Request Forgery to Location Deletion

Published: December 11, 2025

Affected versions: *-7.2.2.2
Patched versions: 7.2.2.3

Original Wordfence record

MediumCVE-2025-12408

Events Manager <= 7.2.2.2 - Unauthenticated Information Exposure

Published: December 11, 2025

Affected versions: *-7.2.2.2
Patched versions: 7.2.2.3

Original Wordfence record

MediumCVE-2025-6976

Events Manager <= 7.0.3 - Authenticated(Contributor+) Stored Cross-Site Scripting via Plugin Shortcodes

Published: July 9, 2025

Affected versions: *-6.6.4.4; 7.0.1-7.0.3
Patched versions: 6.6.5, 7.0.4

Original Wordfence record

HighCVE-2025-6970

Events Manager <= 7.0.3 - Unauthenticated SQL Injection via `orderby` Parameter

Published: July 9, 2025

Affected versions: *-6.6.4.4; 7.0.1-7.0.3
Patched versions: 6.6.5, 7.0.4

Original Wordfence record

MediumCVE-2025-6975

Event Manager <= 7.0.3 - Reflected Cross-Site Scripting via `calendar_header` Parameter

Published: July 9, 2025

Affected versions: *-6.6.4.4; 7.0.1-7.0.3
Patched versions: 6.6.5, 7.0.4

Original Wordfence record

Highest-Severity Records

CriticalCVE-2015-9298

Events Manager <= 5.5.7.1 - Code Injection

Published: August 10, 2015

Affected versions: [*, 5.6)
Patched versions: 5.6

Original Wordfence record

HighCVE-2026-57713

Events Manager – Calendar, Bookings, Tickets, and more! <= 7.3.6 - Unauthenticated PHP Object Injection

Published: July 8, 2026

Affected versions: *-7.3.6
Patched versions: 7.3.7

Original Wordfence record

HighCVE-2026-12987

Events Manager <= 7.3.6 - Unauthenticated SQL Injection

Published: July 1, 2026

Affected versions: *-7.3.6
Patched versions: 7.3.7

Original Wordfence record

HighCVE-2025-6970

Events Manager <= 7.0.3 - Unauthenticated SQL Injection via `orderby` Parameter

Published: July 9, 2025

Affected versions: *-6.6.4.4; 7.0.1-7.0.3
Patched versions: 6.6.5, 7.0.4

Original Wordfence record

HighCVE-2024-11260

Events Manager – Calendar, Bookings, Tickets, and more! <= 6.6.3 - Unauthenticated SQL Injection via Event Status Parameter

Published: February 20, 2025

Affected versions: *-6.6.3
Patched versions: 6.6.4

Original Wordfence record

HighCVE-2020-35012

Events Manager <= 5.9.7.3 - Admin+ SQL Injection

Published: June 7, 2020

Affected versions: *-5.9.7.3
Patched versions: 5.9.8

Original Wordfence record

High

Events Manager < 5.9.7.2 & Events Manager Pro < 2.6.7.2 - Unauthenticated CSV Injection

Published: February 6, 2020

Affected versions: [*, 2.6.7.2)
Patched versions: 2.6.7.2

Affected versions: [*, 5.9.7.2)
Patched versions: 5.9.7.2

Original Wordfence record

MediumCVE-2025-12976

Events Manager <= 7.2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'events_list_grouped' Shortcode

Published: December 17, 2025

Affected versions: *-7.2.2.1
Patched versions: 7.2.3

Original Wordfence record

View all associated vulnerabilities

Need help reviewing an exposed WordPress website?

Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.

WordPress Malware Removal WordPress Security Maintenance Contact 3Zero Digital

Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.

Data Source, Attribution and Methodology

This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.

Return to the Security History Directory